Find, compare, and connect with verified US manufacturers.
dsdomesticsuppliers
All posts
Certifications12 min read

How to Verify a Supplier's SAM Registration and CAGE Code

A SAM registration and a CAGE code are the two records almost every US manufacturer has, and the two most often misread. Here is how to pull both in about five minutes, which fields actually matter, and the long list of things neither one proves.

Introduction

Two records sit behind nearly every manufacturer in the United States that has ever sold anything to the federal government: a registration in the System for Award Management, and a CAGE code. Both are public. Both take a couple of minutes to pull. And both are routinely read as saying far more than they say.

This directory is built on the first of them. The 69,135 manufacturers in it come out of federal registration data, which means we spend a great deal of time looking at exactly these records and watching what buyers conclude from them. The most common mistake is treating an active registration as a credential. It is not one. It is proof that a company filled in a long form, had its name and address validated, and renewed on time. That is genuinely useful, and it is not the same as proof that anyone there can make your part.

This article covers how to look both records up, what each field settles, and where the record stops being evidence.

What SAM Is, and What It Replaced

The System for Award Management is run by the General Services Administration. It is the single front door for entities that want to do business with the federal government, and it absorbed a stack of older systems that used to be separate: the Central Contractor Registration, the Online Representations and Certifications Application, the Excluded Parties List System, and the Federal Agency Registration database.

That consolidation history explains why the record is such a mixed bag. A SAM registration is simultaneously an identity record, a banking record, a tax record, a self-certification questionnaire, and a pointer into a debarment list. Different parts of it carry completely different weight, and the interface does not tell you which is which.

Registration is required before an entity can receive most federal awards. The requirement lands through FAR 52.204-7, which obliges an offeror to be registered in SAM at the time it submits an offer and to stay registered through award. Registration is free. Any service charging a manufacturer to register them in SAM is charging for form-filling, not for access.

The identifier changed in 2022. SAM used to key entities on the DUNS number, a proprietary identifier licensed from Dun and Bradstreet. On April 4, 2022, the government moved to the Unique Entity ID, a 12-character alphanumeric string issued by SAM.gov itself. If you are looking at a supplier record, a vendor master, or an approved supplier list that still keys on DUNS, that data predates the transition and the identifier in it may no longer resolve.

Looking Up an Entity

Go to sam.gov and use the search. You do not need an account to read public entity information, which is a point worth making because a lot of buyers assume they do and give up.

You can search by entity name, by Unique Entity ID, or by CAGE code. Name search is the weakest of the three. Manufacturers register under a legal name that is frequently not the name on the building, the name on the quote, or the name in your ERP system. A shop trading as "Precision Tool" may be registered as a holding company with a different name entirely. If the name search comes back empty, that is not evidence the company is unregistered.

Two better approaches when the name fails. Search by CAGE code if you have one from a drawing, a packing slip, or a previous quote, because the CAGE resolves to exactly one record. Or filter name search by state and scan, which works because most manufacturers register the address of the plant.

One thing that genuinely does hide a record: during registration, an entity chooses whether its information is publicly searchable. An entity that opted out is registered and eligible for award, and simply will not appear in the public search. This is rare among manufacturers chasing federal work, for obvious reasons, but it exists. "Not in SAM" means "not in the public view of SAM," not "not registered."

Reading the Record

Once you have the record open, most of it is noise for a commercial buyer. Seven fields are worth your attention.

Labelled schematic of a SAM.gov entity record, listing the seven fields worth reading and what each one settles. Unique Entity ID: a 12-character alphanumeric issued by SAM.gov, which replaced the DUNS number on April 4, 2022, and is the identifier a federal award is written against. CAGE code: a 5-character alphanumeric issued by the Defense Logistics Agency that identifies the physical location, so a company with three plants holds three codes rather than one. Registration status: Active, Expired, Submitted or Work in Progress, where only Active can receive a new federal award and Expired means the annual renewal lapsed. Expiration date: one year from the last validated submission, described as the single most useful field because an Active record expiring in three weeks is a different risk. NAICS codes: self-selected with a primary flagged, declared by the registrant and verified by nobody, to be treated as a claim about intent rather than capability. Business types: socioeconomic and set-aside flags, where 8(a), HUBZone, SDVOSB and WOSB are program-certified and most of the rest are self-certified. Exclusions: searched separately from entity information, so a clean entity record does not mean an unexcluded entity because the two searches are not the same query

The expiration date is the field most buyers skip and the one that tells you the most. A SAM registration has to be renewed every twelve months, and renewal requires revalidating the entity's information and redoing the representations and certifications. A registration that expired eight months ago tells you something real about the shop's administrative capacity, or about how much federal work it is actually chasing. An Active registration that expires in two weeks tells you to ask whether anyone there is on top of it.

The NAICS codes deserve particular suspicion. A registrant picks its own codes from the full list and flags one as primary. Nobody checks them. We see shops registered under half a dozen manufacturing codes that describe work they have never done, and shops registered under a single code that badly undersells what is on their floor. Declared NAICS is a statement of what a company wants to be considered for. It is not an inventory.

The business type flags split into two groups that the interface displays identically. The 8(a) Business Development program, HUBZone, the Service-Disabled Veteran-Owned Small Business program and the Women-Owned Small Business program involve certification by the Small Business Administration or an approved third party, and a flag for one of those is backed by a process. A large number of the other socioeconomic and ownership designations are self-certified: the registrant asserted them and signed a representation. Both kinds appear as a line in the same list.

CAGE Codes

The Commercial and Government Entity code is a five-character alphanumeric identifier assigned by the Defense Logistics Agency's CAGE Program Office. Foreign entities get an NCAGE code through the equivalent NATO process.

The critical property, and the one most often missed, is that a CAGE code identifies a location, not a company. A manufacturer with a machining plant in Ohio, a fabrication shop in Texas and a corporate office in Illinois holds three CAGE codes. If a drawing, a certificate of conformance, or a first article report cites a CAGE code, it is pointing at one specific facility. Checking that the code on the paperwork matches the facility you audited is a real control, and it is one almost nobody applies.

You can look a CAGE code up two ways. The DLA runs a public CAGE search at cage.dla.mil, which is the authoritative source and will resolve a code to a name and address. Or search the code directly in SAM, since the CAGE appears on the entity record. The DLA tool is better when all you have is the code; SAM is better when you want the code in context with the rest of the registration.

What a CAGE code does not carry is any form of approval. It is a serial number for an address. It implies no qualification, no quality system, no product approval, and no past performance. A shop that has held a CAGE code for thirty years and a shop that was issued one last Tuesday are indistinguishable on that basis alone. When a supplier leads with "we are CAGE coded" as a qualification, they have told you they have an address.

Exclusions Are a Separate Search

This is the mistake with the sharpest consequences. SAM absorbed the Excluded Parties List System, which means debarment and suspension records live in SAM, but they are not part of the entity information view. A supplier can have a clean, active, unremarkable entity record and be excluded.

Exclusions are a distinct query against a distinct dataset, and you have to run it. FAR 9.404 covers the exclusions capability and the government's obligation to check it; if you are a prime flowing requirements down, checking exclusions on your subcontractors is usually your obligation too, not an optional diligence step. An exclusion can attach to an entity, to an individual, or to both, and it can bar participation in federal procurement entirely or only in specific programs.

Run the exclusions search by name and by Unique Entity ID, and run it against the individuals named as officers if the award is significant. A name-only search misses an entity that has reorganised; an identifier-only search misses an excluded principal operating through a new entity.

What Neither Record Proves

It is worth being blunt about the gap between what these records contain and what buyers want them to contain.

Side-by-side comparison headed "What the record does prove" against "What it does not prove", across six paired rows, three of which are drawn as divergent. The legal entity exists and its name, address and identifiers were validated, versus that the company is still trading or that the address is a plant rather than an office. The entity completed federal representations and certifications, versus that any representation is accurate, since most are self-certified and unaudited. The entity is eligible to receive a federal award today if status is Active, versus that it has ever held a contract or performed one acceptably. A CAGE code identifies one specific facility, versus that the facility has any approval, qualification or capability whatsoever, marked as divergent. Declared NAICS codes show what work the registrant says it wants, versus that the shop owns a single machine capable of that work, marked as divergent. And nothing at all about quality systems, versus the note that ISO 9001, AS9100, IATF 16949 and Nadcap appear nowhere in SAM and each must be verified at its own registry, marked as divergent

The quality system gap is the one that catches people. There is no field in a SAM registration for ISO 9001, AS9100, IATF 16949, ISO 13485 or Nadcap. A supplier can hold every one of them or none, and the registration reads identically. Each of those has its own register and its own verification route, and a certificate PDF emailed by the supplier is not verification of any of them.

The liveness gap is the second one. A SAM registration is a snapshot revalidated annually. It does not know that the plant closed in March, that the owner died, that the shop sold its machining capacity and now brokers work, or that the three people who knew how to run the job have left. We track when a company stops appearing in federal registration data for exactly this reason, and the lag between a shop winding down and its record reflecting that is measured in months.

How to Use the Five Minutes Well

A practical sequence, in the order that fails fastest.

Search the CAGE code if you have one, the Unique Entity ID if you have that, and the name with a state filter if you have neither. Read the registration status and the expiration date first, because an expired registration changes the conversation before you read anything else. Note the CAGE code and check it against the facility you are actually buying from, not the one on the letterhead. Run the exclusions search separately, by name and by identifier. Then treat the NAICS codes and the self-certified business types as claims to be confirmed elsewhere, and go and verify any quality certification at the registry that issued it.

What you have at the end is a confirmed legal identity, a current eligibility status, a facility identifier, and a clean exclusions check. That is a sound foundation and it is roughly a quarter of supplier qualification. The rest is capability, and no federal database holds it.

Conclusion

A SAM registration proves an entity exists, completed its representations, and renewed on time. A CAGE code proves a facility has an identifier. Neither proves capability, quality, solvency, or that anyone is still at the address. Pull both, read the expiration date before anything else, run the exclusions search as the separate query it is, match the CAGE code to the building you are actually buying from, and then start the real work of finding out whether the shop can make your part.

Share